Commit 41b37312 authored by Zilin Guan's avatar Zilin Guan Committed by Martin K. Petersen
Browse files

scsi: smartpqi: Fix memory leak in pqi_report_phys_luns() 



pqi_report_phys_luns() fails to release the rpl_list buffer when
encountering an unsupported data format or when the allocation for
rpl_16byte_wwid_list fails. These early returns bypass the cleanup logic,
leading to memory leaks.

Consolidate the error handling by adding an out_free_rpl_list label and use
goto statements to ensure rpl_list is consistently freed on failure.

Compile tested only. Issue found using a prototype static analysis tool and
code review.

Fixes: 28ca6d87 ("scsi: smartpqi: Add extended report physical LUNs")
Signed-off-by: default avatarZilin Guan <zilin@seu.edu.cn>
Tested-by: default avatarDon Brace <don.brace@microchip.com>
Acked-by: default avatarDon Brace <don.brace@microchip.com>
Link: https://patch.msgid.link/20260131093641.1008117-1-zilin@seu.edu.cn


Signed-off-by: default avatarMartin K. Petersen <martin.petersen@oracle.com>
parent 21a16f0f

drivers/scsi/smartpqi/smartpqi_init.c

+10 −3
Original line number Diff line number Diff line
@@ -1241,7 +1241,8 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b 
			dev_err(&ctrl_info->pci_dev->dev,

				"RPL returned unsupported data format %u\n",

				rpl_response_format);

			return -EINVAL;

			rc = -EINVAL;

			goto out_free_rpl_list;

		} else {

			dev_warn(&ctrl_info->pci_dev->dev,

				"RPL returned extended format 2 instead of 4\n");
@@ -1253,8 +1254,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b 


	rpl_16byte_wwid_list = kmalloc(struct_size(rpl_16byte_wwid_list, lun_entries,

						   num_physicals), GFP_KERNEL);

	if (!rpl_16byte_wwid_list)

		return -ENOMEM;

	if (!rpl_16byte_wwid_list) {

		rc = -ENOMEM;

		goto out_free_rpl_list;

	}



	put_unaligned_be32(num_physicals * sizeof(struct report_phys_lun_16byte_wwid),

		&rpl_16byte_wwid_list->header.list_length);
@@ -1275,6 +1278,10 @@ static inline int pqi_report_phys_luns(struct pqi_ctrl_info *ctrl_info, void **b 
	*buffer = rpl_16byte_wwid_list;



	return 0;



out_free_rpl_list:

	kfree(rpl_list);

	return rc;

}



static inline int pqi_report_logical_luns(struct pqi_ctrl_info *ctrl_info, void **buffer)